Bitget hacker moves $83 million in stolen XRP that Ripple cannot freeze

The attacker who stole assets from crypto exchange Bitget has shifted roughly $83 million in XRP out of three holding wallets, while additional balances — about $75 million tied to the original five accounts — remain in attacker-controlled addresses. The theft, which Bitget has revalued to $387.5 million after including transfers in Zcash and TRON, initially saw about 103 million XRP diverted from the exchange. Blockchain records show two of the wallets that once held about 20 million XRP each were nearly emptied, falling to roughly 23 and 55 XRP respectively, and a third was reduced to approximately 5.8 million XRP. Observers noted accelerated movement overnight: a balance of about 70 million XRP across the five accounts at 04:32 UTC dropped to roughly 49 million eight hours later, with roughly 54 million XRP leaving the original holding accounts overall. Because XRP is the native token of the XRP Ledger, the network lacks a mechanism for a third party to freeze those coins; Ripple can freeze tokens it issues on the ledger but cannot block transactions involving XRP itself. That limitation means recovery options depend on where the attacker routes funds next: centralized exchanges receiving stolen XRP can restrict recipient accounts and block withdrawals, but they cannot freeze funds while they remain in wallets controlled by the thief. Stablecoin issuers have taken some action. Circle and Tether reported freezing about $320,000 in USDC and USDT connected to the breach, using blacklist controls embedded in their tokens. Bitget said its protection fund will absorb the losses and that customer balances are unaffected; the exchange outlined a phased resumption of withdrawals beginning Sept. 28 for bitcoin and continuing through Oct. 2 for other tokens. Market data showed XRP trading around $1.54 at the time of reporting, and analysts noted the initial 103 million XRP haul was worth roughly $160 million at that price. The chain-level transfers tracked by observers indicate the attacker is dispersing funds across additional wallets, though on-chain movements do not reveal whether any of the stolen XRP have been sold.